A cursory look at OWASP’s IoT Security Guidance will highlight just how many elements in the IoT ecosystem could be exploited. Among others, these include the web interface, network, transport encryption layer, mobile app and device firmware. The latter is a key area of focus for the prpl Foundation, a non-profit which is trying to coral the industry into taking a new hardware-based approach to IoT security. Cesare Garlati, chief security strategist, claims that hackers could exploit IoT chip firmware to re-flash the image, allowing them to reboot and execute arbitrary code. “The issue with this kind of attack is that it gives the hackers complete control of the device and it is persistent; it can’t be undone via a system reboot, for example”, he tells Infosecurity. The answer is to ensure IoT systems will only boot up if the first piece of software to execute is cryptographically signed by a trusted entity. “It needs to match on the other side with a public key or certificate which is hard-coded into the device, anchoring the ‘Root of Trust’ into the hardware to make it tamper proof ”, says Garlati.

Worst Case Scenario

The prpl Foundation also points out that proprietary code is less secure than open source, that connectivity is often poorly engineered and that too many systems allow lateral movement at a chip level, ignoring the best practice rule of ‘security by separation’. The best way to mitigate the latter issue is via chip-layer virtualization, Garlati explains. The question is, beyond data theft and DDoS-related outages, what harm could deficient IoT security genuinely do to society? Pioneering work by Miller and Valasek into connected car security first showed us back in 2015 how a vehicle could be remotely hacked and consequently steering and brakes manipulated, potentially to catastrophic effect. Then Kremlin-linked attacks on Ukrainian power stations in December 2015 and again in 2016 highlighted how – in one instance – IoT firmware could be successfully hacked and reflashed to disrupt energy supplies for hundreds of thousands. “The pressure brought by consumer groups, lawyers and governments will force IoT makers to produce more secure kit” “From isolated incidents to widespread chaos that could be possible with the manipulation of the electrical grid, the potential for damage is huge. It’s almost limitless” As the IoT works its way into ever more critical computing systems, the potential for devastating attacks multiplies, according to Sean Joyce, US cybersecurity & privacy leader at PwC. “Even the US military is concerned about IoT risks,” he explains. “A recent Government Accountability Office report outlined several national threat scenarios in which IoT security risks might harm Defense Department operations, equipment or personnel. These examples include the potential sabotage of a mission or equipment, operations security and intelligence collection and the endangerment of leadership.” Attacks might be easier to launch than many IoT-manufacturers think. Munro claims that simply by hacking and remotely controlling home smart thermostats en masse, an attacker could take down the entire power grid.

What Can We Do?

Given the huge security challenges associated with current IoT systems, the market has clearly failed, despite 90% of consumers now believing security should be built into devices, according to Irdeto. However, governments are responding. In the US, senators have introduced the Internet of Things Cybersecurity Improvement Act, designed to improve baseline security in the market by tightening the requirements for government suppliers. In the UK, the government recently published guidelines for connected car manufacturers, in a bid to improve standards. However, Munro thinks the rightapproach should combine regulation and litigation. “Regulations take a long time,” he says.“It’s fantastic to see, but in the meantime we need to see more litigation [of the kind faced recently by] Bose and WeVibe. The pressure brought by consumer groups, lawyers and governments will force IoT makers to produce more secure kit.” Until then, it’ll be down to CISOs to mitigate IoT security risk inside the enterprise. Yet according to PwC’s latest research, only 35% of organizations plan to assess device and system interconnectivity and vulnerabilities across the business ecosystem. This needs to change. IT also needs to strictly monitor IoT device usage, enable security protection on all devices, segment devices onto non-critical networks, encrypt all IoT comms and educate staff about the dangers, says Context’s Higginson “From isolated incidents to widespread chaos that could be possible with the manipulation of the electrical grid, the potential for damage is huge,” warns prpl Foundation’s Garlati. “It’s almost limitless.

In the optimal situation, there is no way that anyone should be able to access, much less hijack, the critical functions of an IoT device such as a drone. While the power for destruction from just one drone may seem paltry, directing these drones in large numbers at a target is a very real, and dangerous, possibility – as confirmed by this news.

Last week I had the pleasure of attending Embedded World 2017 in Germany as I was invited to give a couple of presentations on the pioneering work we have been doing at the prpl Foundation with regards to the prplHypervisor™ and prplPUF™ APIs for securing IoT. As it turns out, IoT was the top line at the conference that drew in more than 30,000 trade visitors – and the event solidified the notion that embedded computing is now synonymous with IoT.

Drones wide open to hijack threats

Don’t let that flying drone out of your sight: you never know where it might turn up next.

Last year, customers of Amazon in Cambridge began signing up for a novel delivery option. A 25kg drone, which is able to fly up to 10 miles gripping a book-sized package underneath, took just 13 minutes to fly from the warehouse nearby, landing briefly to drop the order on a delivery mat marked with the distributor’s single-letter logo in the customer’s rear garden.

The world’s great and good of the information security industry descended on San Francisco this week for RSA Conference 2017. On the surface, it looked like more of the same this year. There weren’t a huge amount of new companies exhibiting this year and the traditional vendors all seemed to be consolidating and streamlining their product lines in attempt to demystify buyers. It even saw the McAfee brand back this year after a noticeable absence in the previous “Intel Security” era.

In 2016, the danger posed by the Internet of Things (IoT) became a reality. Add in factors such as the Mirai botnet and industrial control systems, and the problem becomes more than just Fitbits being connected to the network.

The problem was countered with the first industry guidance in November 2016, when both the Department of Homeland Security and NIST issued documents on IoT: with the DHS advising manufacturers, services providers, developers and business-level consumers; while NIST went for more detail for manufacturers/developers with guidance on how to engineer safer products.

Quick look – This session will address four key elements that have introduced serious weaknesses into the IoT: proprietary systems, connectivity, unsigned firmware and lateral movement. Discussion will showcase a new approach to IoT security demonstrating how SoC virtualization and security through separation can address these vulnerabilities, which have already been shown to have potentially life-threatening consequences.

Reposting from Automotive Testing Technology International

When it comes to testing the components of modern connected cars, of course pen-testing (penetration testing) has its place; however, it is no substitute for solid product development.

In testing, companies often operate under the notion that an identified problem can be fixed or patched. This may be true for some areas of testing, but for security, it is not sufficient. Security needs to be built-in, from the ground up. And that means starting at the hardware layer, which is seldom done today, but which is completely viable given the advancements in silicon and other connected vehicle technologies.

Debut of the prplHypervisor™ to Occur at the IoT Evolution Expo in Las Vegas

SANTA CLARA, CA–(Marketwired – Jul 11, 2016) – The prpl Foundation today announced the upcoming debut of the prplHypervisor™ at the IoT Evolution Expo in Las Vegas. The prplHypervisor™ is an industry-first light-weight open source hypervisor specifically designed to provide security through separation for the billions of embedded connected devices that power the Internet of Things.

SANTA CLARA, CA – Cesare Garlati, chief security strategist of prpl Foundation and co-founder and co-chair of the Mobile Working Group at Cloud Security Alliance, will give a keynote speech on putting security into the future of Internet of Things (IoT), cloud and mobile at the Cloud Security Summit in Milan on Wednesday 18th May. The summit is the first edition of an annual event which aims to create dialogue between institutions, industry and small and medium European enterprises, and promote the sharing of information and experiences with a look to Europe and beyond.

About Cesare Garlati

This is my personal blog about disruptive technology trends such as mobile, cloud and the Internet of things. It's full of my reasoned opinions, some of which will turn out to be absolutely wrong. You should not rely on anything in this blog for any reason other than for amusement.

This blog occasionally quotes excerpts from other publications, in which case it is done under Fair Use. I despise copyright trolls and think the EFF is due for sainthood any day now.

I am an active member of the Cloud Security Alliance, RISC-V and prpl Foundation: some of my writing will appear here too if it's relevant. The opinions here are mine and mine alone, and are not representative of any professional organizations I belong to.